Dealing with HTTP w00tw00t attacks
From your error log they are sending a HTTP/1.1 request without the Host: portion of the request. From what I read, Apache replies with a 400 (bad request) error to this request, before handing over to mod_security. So, it doesn’t look like your rules will be processed. (Apache dealing with it before requiring to hand … Read more